BizzleBot
814520f8cc
Upgrade nodemailer 6.x→8.x (2 CVEs fixed)
2026-02-19 11:10:00 +00:00
BizzleBot
c8021495a1
security: add future date guard to entry validation
...
- Zod refine rejects dates beyond today in createEntrySchema
- Per-day 24h hour cap already in entries.js (prev commit)
- totalHours populated in history endpoint (prev commit)
- Removed duplicate security headers from nginx (Caddy handles)
2026-02-19 06:19:05 +00:00
BizzleBot
a0234cdd31
production hardening: future-date guard, per-day hour cap, totalHours in history, header cleanup
2026-02-19 04:48:43 +00:00
BizzleBot
47c35c1e3a
security: QA Council audit fixes
...
- Remove JWT secret fallbacks (fail on startup if missing)
- Hash refresh tokens with SHA-256 before DB storage
- Add Zod validation to bulk-approve, bulk-reject, update-user, copy-week
- Add global API rate limiting (100 req/15min per IP)
- Fix nginx X-XSS-Protection header (align with Helmet)
- Remove --accept-data-loss from Dockerfile CMD
- Create .gitignore to protect secrets from commits
- Secure .env file permissions (chmod 600)
2026-02-17 02:09:26 +00:00
BizzleBot
70ed672381
Fix: ManageUsers component missing useAuth() - caused blank admin page
...
The ManageUsers sub-component referenced user?.role for conditional
role dropdown options but didn't call useAuth() to get the user object.
This caused 'user is not defined' JS errors and blank admin pages.
Browser E2E: 20/20 tests pass.
2026-02-16 20:24:34 +00:00
BizzleBot
f718a76153
Coastal Timesheet v2 — full feature buildout
...
Features:
- Copy Previous Week (entries duplication)
- Bulk Approve/Reject (admin workflow)
- Overtime tracking (employee + admin views)
- DayCard component with auto-save
- PDF generation, email notifications
- React + Tailwind frontend, Prisma + PostgreSQL backend
- Docker deployment (3 containers)
2026-02-16 10:01:39 +00:00
BizzleBot